Coinbase urged Bitcoin developers on Oct. 13 to accelerate preparations against future quantum computing attacks, warning that upgrading Bitcoin's cryptographic security could take several years. In a blog post, the exchange said that while the network's transition to post-quantum (PQ) signature schemes is complex and will take years, preparation should commence immediately.

The recommendations do not represent approved upgrades to Bitcoin's network, but they lay out the technical directions Coinbase believes should shape the transition, including flexible signature designs, hybrid schemes, and accommodations for institutional custody. That timeline pressure reflects how Bitcoin changes: signature rules are enforced by consensus, so any upgrade would need broad agreement among developers, miners, and node operators — a process that has historically unfolded over years.

Flexible Signature Design at the Core

Central to Coinbase's proposal is a PQ signature system built with a flexible design that allows multiple signature systems rather than locking the network into a single scheme. The exchange acknowledged that some currently proposed solutions — P2MR (BIP-360) and P2TRv2 — appear to offer this flexibility, and identified both as potential foundations for Bitcoin's post-quantum transition.

PQ signatures already exist beyond Bitcoin: the U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024, but Bitcoin's protocol does not natively support any of them, leaving the network to weigh which designs fit its constraints.

Beyond flexibility, Coinbase called for an approach that would allow active Bitcoin wallets to use hybrid signature systems, supporting both legacy signatures and PQ schemes during the migration. The exchange also recommended stateless PQ signature schemes alongside stateful ones, given their security, and emphasized that any PQ scheme must be compatible with multi-party computation (MPC), a major consideration for institutional users.

Coinbase additionally acknowledged the need for a path that would allow addresses to migrate late to PQ schemes, though it noted this should be considered independently from the technical work focused on adding PQ signature schemes to Bitcoin as soon as possible.

7.1 Million BTC With Exposed Public Keys

The statement follows growing concern about cryptocurrency addresses with exposed public keys and the broader threat quantum computing poses to crypto. Last week, Ethereum Foundation researcher Justin Drake warned that the crypto community would enter "bunker mode" due to quantum computing threats, citing breakthroughs in AI for advanced mathematics and noting that AI models could soon recover private keys from public keys.

According to a Project Eleven report published last year, around 7.1 million BTC are held in addresses whose public keys have already been exposed on-chain, making them vulnerable to a future quantum attack. Public keys generally become visible once coins are spent from an address, and a sufficiently powerful quantum computer could in principle derive a private key from a public key — the mechanics behind the exposure concerns. On Ethereum, 65% of ETH face similar exposure. With many of these BTC sitting in lost or dormant addresses, there are concerns that quantum computing could eventually expose them.

Security Pressures Beyond Quantum

Bitcoin has more than quantum computing to contend with. A few months ago, the Bitcoin cold wallet Cold Card was affected in a broad attack that led to the loss of over $100 million. In a more recent incident, Ledger users lost around $100 million in a supply chain attack targeting one of its resellers, Cryptobillis, in which bad actors implanted a spy chip in Ledger's cold wallets to access users' recovery phrases and steal assets. Together, the incidents underscore that custody security remains a near-term concern in its own right, separate from the longer-horizon quantum debate.

This article is for informational purposes only and does not constitute financial, investment, or cybersecurity advice. It was originally published by The Market Periodical.